CISA Urges Immediate Patching of Exploited SharePoint Vulnerabilities
Summary
CISA added SharePoint flaw CVE-2026-56164 to its KEV catalog and urged federal agencies to patch it within three days. It also highlighted other SharePoint flaws, including exploited zero-days, and recommended patching and intrusion hunting.
Key points
- CVE-2026-56164 is a remotely exploitable, unauthenticated privilege-escalation flaw fixed in Microsoft's July 2026 updates; CISA added it to the KEV catalog.
- CISA urged federal agencies to patch CVE-2026-56164 within three days, in line with BOD 26-04 recommendations.
- Microsoft also patched CVE-2026-55040, a security-feature bypass, and CVE-2026-58644, a remote code execution flaw; CISA warned these unflagged vulnerabilities still pose a risk.
- CISA highlighted CVE-2026-32201, exploited as a zero-day before its April patch, and CVE-2026-45659, an exploited code-execution flaw patched in May.
- CISA warned that exploitation can involve remote code execution and post-exploitation activity, including IIS machine-key theft and deserialization techniques to gain persistence and deploy malware.
- Recommended measures include applying patches, monitoring and hunting SharePoint servers, rotating IIS machine keys, enabling tailored logging, limiting internet exposure, and restricting administration access.
Article Details
- Vulnerability Types
- Privilege escalation
- Security feature bypass
- Arbitrary code execution
- Spoofing
- Severity
- Critical severity is reported for CVE-2026-55040 and CVE-2026-58644; severity for the other vulnerabilities is not specified.
- Affected Versions
- SharePoint Server Subscription Edition
- SharePoint Server 2019
- SharePoint Server 2016
- Exploitation Status
- reported
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Monitor SharePoint servers for unusual activity and hunt for intrusions.
- Ensure security products cover all SharePoint web applications.
- Rotate IIS machine keys and enable tailored logging.
- Avoid exposing SharePoint servers directly to the internet and restrict access to administration interfaces.
MITRE ATT&CK
CVE
CVE-2026-32201The cybersecurity agency also draws attention to CVE-2026-32201, a spoofing issue in SharePoint patched in April after being exploited in attacks as a zero-day.CVE-2026-45659Another exploited SharePoint flaw is CVE-2026-45659, a code execution issue patched in May via an out-of-band security update, which was added to CISA’s KEV list in early July.CVE-2026-55040Microsoft’s latest round of security updates also resolved CVE-2026-55040 and CVE-2026-58644, critical-severity SharePoint bugs that could be exploited remotely to bypass a security feature and to execute arbitrary code.CVE-2026-56164The freshest of the exploited flaws is CVE-2026-56164, a privilege escalation issue that can be exploited remotely without authentication, and which was resolved with Microsoft’s July 2026 Patch Tuesday updates.CVE-2026-58644Microsoft’s latest round of security updates also resolved CVE-2026-55040 and CVE-2026-58644, critical-severity SharePoint bugs that could be exploited remotely to bypass a security feature and to execute arbitrary code.